[skill-rewrite] Refresh foundry-agt upstream pin to AGT 3.7.0 / MAF 1.6.0

[Copilot]

This refresh updates foundry-agt to the latest validated upstream package set and current upstream SHA, while keeping the pin file and skill wrapper aligned with the automated freshness gates. It also closes out two upstream-documented workarounds that no longer reproduce and repairs the moved OWASP reference.

• Pin refresh

  • bumped agent-governance-toolkit from 3.6.0 to 3.7.0
  • bumped agent-framework from 1.3.0 to 1.6.0
  • updated upstream.pinned_sha to 279db99f1909ae78b69851f6893a6a6b3b631461
  • advanced last_validated and validated_by

• Validation contract

  • updated validation.script caps to keep compatible-release specifiers while targeting the new floors
  • preserved the runnable pin-validation flow used by CI

  pip install --quiet \
    "agent-governance-toolkit[full]~=${PINNED_VERSION:-3.7.0}" \
    "agent-framework~=${PINNED_AGENT_FRAMEWORK_VERSION:-1.6.0}"

• Known-issue lifecycle

  • marked KI-002 and KI-003 as closed_upstream_fixed
  • removed the corresponding stale-workaround prose from SKILL.md
  • kept KI-001 open; the Windows UTF-8 workaround still remains documented

• Docs/frontmatter sync

  • patch-bumped SKILL.md metadata version only
  • updated the broken OWASP link to the current upstream path
  • kept the change surface limited to SKILL.md and references/upstream-pin.md